CVE-2025-64174: Openmage Magento Stored XSS Vulnerability

CVE-2025-64174 Overview

CVE-2025-64174 is a stored Cross-Site Scripting (XSS) vulnerability in OpenMage Magento-LTS, a long-term support alternative to Magento Community Edition. Versions 20.15.0 and below fail to escape translation strings and URLs rendered by app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. An attacker with admin database access or control over the admin notification feed source can inject script into the admin backend. Execution occurs when another administrator views the notifications grid. The issue is resolved in version 20.16.0 and is tracked under [CWE-79].

Critical Impact
Stored script injection into the Magento admin interface enables session theft, admin action hijacking, and further compromise of the storefront when an authenticated administrator loads the notifications grid.

Affected Products

OpenMage Magento-LTS versions 20.15.0 and earlier
Instances consuming the upstream admin notification feed
Deployments where non-trusted translation packs are installed

Discovery Timeline

2025-11-06 - CVE-2025-64174 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64174

Vulnerability Analysis

The vulnerable code path lives in the admin notification grid renderer. The render() method in Actions.php concatenates the value returned by $row->getUrl() and translated strings such as Read Details, Mark as Read, and Are you sure? directly into HTML and inline JavaScript. Because neither the URL nor the translation output is escaped, any HTML or script characters present in those values are rendered verbatim by the browser.

A second sink exists in app/design/adminhtml/default/default/template/widget/grid/massaction.phtml, where $_item->getLabel() values for mass-action options were emitted without HTML escaping. The combined effect is script execution inside the authenticated admin origin.

Root Cause

The root cause is missing output encoding on data that crosses a trust boundary. The renderer treats translation strings and notification URLs as safe HTML, but both are attacker-influenceable. An admin with direct database write access can pollute the notification store, and the admin notification feed itself is an external input consumed by the application.

Attack Vector

Exploitation requires either write access to the notification data or the ability to influence the admin notification feed source. The injected payload is stored server-side and executed later when an administrator loads the notifications grid, giving the attack persistence and user interaction inside a privileged context.

php

// Patch excerpt: app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php
public function render(Varien_Object $row)
{
-    $readDetailsHtml = ($row->getUrl())
-        ? '<a target="_blank" href="' . $row->getUrl() . '">' .
-            Mage::helper('adminnotification')->__('Read Details') . '</a> | '
+    $escapedRowUrl =  $this->escapeUrl($row->getUrl());
+    $readDetailsHtml = ($escapedRowUrl)
+        ? '<a target="_blank" href="' . $escapedRowUrl . '">' .
+            $this->escapeHtml(Mage::helper('adminnotification')->__('Read Details')) . '</a> | '
         : '';

    $markAsReadHtml = (!$row->getIsRead())
         ? '<a href="' . $this->getUrl('*/*/markAsRead/', ['_current' => true, 'id' => $row->getId()]) . '">' .
-            Mage::helper('adminnotification')->__('Mark as Read') . '</a> | '
+            $this->escapeHtml(Mage::helper('adminnotification')->__('Mark as Read')) . '</a> | '
         : '';

+    $deleteConfirmHtml = sprintf("deleteConfirm('%s', this.href)",
+        Mage::helper('core')->jsQuoteEscape(Mage::helper('adminnotification')->__('Are you sure?')),
+    );
}

Source: OpenMage/magento-lts commit 9d604f5. The patch introduces escapeUrl() and escapeHtml() calls around all attacker-influenceable sinks and moves the deleteConfirm argument through jsQuoteEscape() before insertion into the onClick handler.

Detection Methods for CVE-2025-64174

Indicators of Compromise

Unexpected HTML tags, <script> fragments, or on*= handlers stored in the adminnotification_inbox table title, description, or url columns.
Notification feed responses served from notifications.magentocommerce.com or configured mirrors containing markup beyond plain text.
Translation CSV files under app/locale/ containing angle brackets, javascript: URIs, or template-literal escapes.

Detection Strategies

Review the admin notifications table for rows whose url field does not begin with http:// or https:// or that contain quote characters.
Compare deployed Actions.php and massaction.phtml against the fixed 20.16.0 versions to confirm escapeHtml() and escapeUrl() calls are present.
Log and inspect admin session activity following notification grid loads for anomalous XHR calls to admin action endpoints.

Monitoring Recommendations

Alert on writes to core_translate and adminnotification_inbox originating from non-application database users.
Monitor egress from the admin server to the notification feed URL and validate response content-type and structure.
Instrument the admin backend with Content Security Policy reporting to surface inline script violations.

How to Mitigate CVE-2025-64174

Immediate Actions Required

Upgrade OpenMage Magento-LTS to version 20.16.0 or later, which contains the escaping fixes.
Audit the adminnotification_inbox table and purge or sanitize any rows containing HTML control characters.
Rotate admin session cookies and credentials if a compromise of the notifications grid is suspected.

Patch Information

The fix is delivered in commit 9d604f5489851c54a96fca31b0e13c414b0fb20a and released as part of version 20.16.0. Details are documented in GitHub Security Advisory GHSA-qv78-c8hc-438r and the upstream commit.

Workarounds

Disable the admin notification feed by setting system/adminnotification/severity handling to suppress remote-sourced entries until the patch is applied.
Restrict direct database access to the Magento schema to the application service account only.
Deploy a strict Content Security Policy on the /admin path that forbids inline scripts and unapproved event handlers.

bash

# Verify installed magento-lts version and upgrade via Composer
composer show openmage/magento-lts | grep versions
composer require openmage/magento-lts:^20.16.0
php bin/magento cache:flush